LazyLoad Plugin CVE-2026-100196

Requires the target WordPress site to accept comments on pages where the LazyLoad plugin (<=2.4.0) applies its lazy-load image/iframe rewriting. The attacker submits an unauthenticated comment whose payload is an event handler hidden inside a malformed ('broken') attribute region so it survives wp_kses_data sanitization on save; the payload only becomes executable because the plugin's render-time str_replace transformation rewrites markup and promotes the handler to a real DOM attribute. Key limiting factor: a site administrator must manually approve the crafted comment before it is served to visitors, so exploitation depends on moderated-comment approval and is not fully self-contained. Execution then occurs for any visitor who loads the affected page.

Severity signals are moderate and partially conflicting. Wordfence assigns CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), driven by network vector, no attacker privileges, and a changed scope (script executes in victims' browsers). However, the vector sets UI:N while the description explicitly states that a site administrator must approve the crafted comment before it is served - this is interaction by a privileged third party, so real-world exploitation is NOT the drive-by, zero-interaction scenario UI:N implies; verify the UI metric with the vendor, as it materially lowers practical risk. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. Net: this is a credible stored-XSS issue in a popular plugin, but the mandatory administrator-approval gate and the absence of any exploitation-probability signals make it a patch-in-normal-cycle item rather than an emergency, despite the 7.2 'High' label.

An unauthenticated attacker posts a comment on a WordPress site running the LazyLoad plugin (<=2.4.0), hiding an event handler inside a broken/malformed attribute region that passes WordPress's wp_kses_data allow-list on save. A site administrator later approves the comment; when the plugin's render-time str_replace lazy-load transformation rewrites the markup, the concealed handler is promoted to a live DOM attribute, and the script executes in the browser of every visitor who subsequently views that page. No public exploit code was identified at time of analysis, and low attack complexity (AC:L) means crafting the payload is reliable once the technique is known.